Parent

Methods

Class/Module Index [+]

Quicksearch

Rex::PeScan::Analyze::ContextMapDumper

Attributes

pe[RW]

Public Class Methods

new(pe) click to toggle source
# File lib/rex/pescan/analyze.rb, line 307
def initialize(pe)
        self.pe = pe
end

Public Instance Methods

scan(param) click to toggle source
# File lib/rex/pescan/analyze.rb, line 311
def scan(param)
        dest = param['dir']
        path = ''

        ::FileUtils.mkdir_p(dest)

        if(not (param['dir'] and param['file']))
                $stderr.puts "No directory or file specified"
                return
        end

        if (param['file'])
                path = File.join(dest, File.basename(param['file']) + ".map")
        end

        fd = File.new(path, "wb")
        pe.all_sections.each do |section|

                # Skip over known bad sections
                next if section.name == ".data"
                next if section.name == ".reloc"

                offset = 0
                while offset < section.size
                        byte = section.read(offset, 1)[0]
                        if byte != 0
                                chunkbase = pe.rva_to_vma(section.base_rva) + offset
                                data = ''
                                while byte != 0
                                        data << byte
                                        offset += 1
                                        byte = 0
                                        byte = section.read(offset, 1)[0] if offset < section.size
                                end
                                buff = nil
                                buff = [ 0x01, chunkbase, data.length, data].pack("CNNA*") if data.length > 0

                                fd.write(buff) if buff
                        end
                        offset += 1
                end

        end


        fd.close
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.